InformAction Forums

Currently I have NoScript allowing scripts globally for compatibility and convenience reasons, but still want to block Java, Flash, etc. So currently, I have to apply those restrictions to whitelisted sites too, but that means I can only temporarily allow those items.
Is there a way to permanently whitelist sites (ex. Youtube) on plugins only? (w/o having to block javascript by default). Sure, I can dump NoScript for FlashGot or whatever, but NoScript still protects in more areas such as ClearClick, XSS, JAR, ABE, etc. Please reply with possible solutions.

Site-Specific Permissions, a long-running thread, discusses this feature, which is expected in the next generation of NoScript, 2.x. The release time is not yet known. We are all looking forward to it.

Until then, I would suggest that it is better not to uncheck "Apply to trusted sites too", but rather to click on the placeholder (the red NoScript block-logo) for individual videos that you want to watch, e. g., at YouTube. Otherwise, you are allowing whatever random videos are playing upon each visit, and everything else as well. Better to choose a few than to allow a million.

I'd also ask you to reconsider allowing JavaScript globally "for compatibility and convenience reasons".
What compatibility? Please name a URL or situation with which NoScript cannot be configured so as to be compatible.

As for convenience, please read the NoScript Quick Start Guide, and peruse the NoScript FAQ. I think you'll find that you'll have your favorite sites configured permanently in a relatively brief period of time. And isn't having a virus, spyware, or other malware, and the damage they can do (passwords stolen, bank account drained, identity theft) a bit more inconvenient?

Sure, I can dump NoScript for FlashGot...

The functions of FlashGot are not in any way related to the purpose of NoScript, and it is not a substitute.

Thank you for your interest in NoScript, and for recognizing its value even outside the scripting arena. Please let us know if we can be of further assistance.

Should you need any help in configuring NoScript to work with any given site, we are always pleased to help you.

Until then, I would suggest that it is better not to uncheck "Apply to trusted sites too", but rather to click on the placeholder (the red NoScript block-logo) for individual videos that you want to watch, e. g., at YouTube. Otherwise, you are allowing whatever random videos are playing upon each visit, and everything else as well. Better to choose a few than to allow a million.

That's exactly why I've enabled "Apply to trusted site too" in the first place.

I'd also ask you to reconsider allowing JavaScript globally "for compatibility and convenience reasons".
What compatibility? Please name a URL or situation with which NoScript cannot be configured so as to be compatible.

I've used NoScript in it's default state for years now. Many sites do not work correctly without javascript, and after a while surfing, NoScript becomes quite annoying. I also go to lot of one-click file hosters (Rapidshare, Megaupload, etc.), and most of them requires javascript to be enabled (sometimes even whitelisting the site doesn't work, because other associated sites are blocked).
An example is this bookmarklet called PageZipper, which doesn't work to its full potential with NoScript. It's supposed to load multiple pages when scrolling down, but NoScript only allows it to load 2.

As for convenience, please read the NoScript Quick Start Guide, and peruse the NoScript FAQ. I think you'll find that you'll have your favorite sites configured permanently in a relatively brief period of time. And isn't having a virus, spyware, or other malware, and the damage they can do (passwords stolen, bank account drained, identity theft) a bit more inconvenient?

Believe me, I've configured it extensively, but as I explore more of the web, it just becomes a nuisance.
Lastly I've compiled a list of my security setup, after reading it, you tell me whether I need NoScript or not.

Network Protection
Untangle
Router with SP1 firewall and Comodo Secure DNS.
Real-time Protection
Comodo Internet Security (Firewall+HIPS)
Avira Free
WinPatrol Free
Passive Protection
Windows 7 UAC (no prompts, thanks to UACTweak)
Disallowed-by-default Software Restriction Policy
SpywareBlaster
On-demand Scanning
A-squared Free
Comodo AV
Malwarebytes' Anti-malware
Prevx CSI
Returnil Virus Guard
Sophos Anti-Rootkit
SUPERAntispyware
Firefox Add-ons
Adblock Plus
NoScript (custom Global allow)
LinkExtend
Others
HiJackThis (+ http://www.hijackthis.de/)
VirusTotalUploader
Software Updates
RSS Feeds: kaldata.net, Freeware Guide, FileHippo.com, Softpedia
KC Softwares SUMo
Secunia PSI
Update Notifier
System Virtualization
Returnil Home Free
System Backup
Windows 7 System Image

J. L. wrote:Lastly I've compiled a list of my security setup, after reading it, you tell me whether I need NoScript or not.

NoScript provides you with useful protections your setup doesn't provide. See Giorgio's postings in Is default-deny for JavaScript necessary for good security?.

It's more annoying than useful for me, plus it isn't truly necessary. Anyways, my main question is already answered, I'll be waiting for version 2.x.

J L. wrote:Many sites do not work correctly without javascript, and after a while surfing, NoScript becomes quite annoying. I also go to lot of one-click file hosters (Rapidshare, Megaupload, etc.), and most of them requires javascript to be enabled (sometimes even whitelisting the site doesn't work, because other associated sites are blocked).

It looks like your mind is already made up, but you *do* know that you can put your favorite and trusted sites (and their associated sites) in your Whitelist, which allows them permanently, right? You then do not need to take any further action with NoScript when you visit these sites.

Just thought I'd pass that along, and curious why you wouldn't use that feature. Also note the option in NoScript > General, "Allow sites opened through bookmarks." Then all of your bookmarked sites will be allowed without further "annoyance" on your part. Cheers.